Knowledge Distillation 
Model extraction attacks are closely related to knowledge distillation (KD) [1]}, where the adversary acts as the student who approximates the behaviors of the teacher (victim) model. The student can learn from soft labels or hard labels. KD with soft labels has been widely applied due to the fact that soft labels can carry a lot of useful information [2]}, [3]}.
